Analysis
- user interaction
yes - max time kernel
35s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CCS-Free.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target CCS-Free.exe
- Size 27.9MB
- Sample260808-w4l2tssfpc
- SHA256 d0fe78f8db7d1d3bc8ee718ab81703be66bf38ba64d624e323df0b11cc758645
- MD5 f86d1334df7ee13f1c32e04af4a44096
- SHA1 86e2cde5fec5a999744b690848c3fcf52a736853
- SHA512 3b47e7a01b2a1f998a39cf7195c1ec115a304df569aa7cd27a2f6e82a39c62641d45a75a20b57230f41fa0e437be050ae835ea7b79b2845984c19fc0ef5db1ac
- SSDEEP 786432:iLme6D3ZhjckiWcf62aj6g0E6spwQ0Y1ss9aoD:heOZJckiWcyR9fpwZYS6d
- TLSH T11E572357B5D6A3E4DB834AB0664612CB33C1656F82DE942C33CE78023531DA74A8AF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 14 1204 CCS-Free.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
pid Process 2160 Process not Found - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1204 CCS-Free.exe 1204 CCS-Free.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Kaspersky Lab CCS-Free.exe File created C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll CCS-Free.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32 CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll" CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA} CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686} CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll" CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment" CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0" CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both" CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0" CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class" CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} CCS-Free.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32 CCS-Free.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class" CCS-Free.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe 1204 CCS-Free.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 CCS-Free.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1204 CCS-Free.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CCS-Free.exe"C:\Users\Admin\AppData\Local\Temp\CCS-Free.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll
- Size 23KB
- SHA256 4cc64ce68c8a72ddbf19c9529c978044718154659ce9ae0dc73ab1e8d6227e3b
- MD5 7c55fdb6ef4998640f26d70eb81281aa
- SHA1 197e83951692c23fdff29a256865468ac8e61051
- SHA512 245f494d97c0b024587eaea4102ce868d2dd6c6322219faea1e2d18585321347de21ad4ebe33e3999b2dc792c20f3afa799557a455ae59523ea2e7eecf9c4413
- SSDEEP 384:s4ZzQHvX1MshplRXvPKgGthUpH8DZvzZUhCm/Ct:s1PlM0plR/JGtup8lvzZxKs
- TLSH T1B0B27CC2BF5D04E2DAA14674CCE31907FCB7B6E417642AAF026095660ED73D2BF27429
- MD5 SHA1 SHA512 SSDEEP TLSH